Information Disclosure Vulnerability in Grav by GetGrav

CVE-2026-109326

What is CVE-2026-109326?

Grav prior to version 2.1.7 is susceptible to an information disclosure issue that allows unauthenticated attackers to access sensitive data residing in nested .git directories. The vulnerability stems from the improper configuration of bundled web servers like nginx, lighttpd, IIS, and Caddy 2, which only restrict access to the .git directory at the document root. Consequently, attackers can request directories such as user/.git, gaining access to Git configuration files, refs, and repository objects. This exposure can potentially lead to the reconstruction of unpublished project history and sensitive secrets.

References